TI-2026-74886 CVE-2026-109383 · GHSA-2m5v-pch6-74hx
Certificate validation bypass in undici Agent drops custom TLS checks
Priority MEDIUM 40
undici is an HTTP client library for Node.js.
RHSA-2026:87703
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-10-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs26-1:26.12.1-0.1.hum1@aarch64, nodejs26-1:26.12.1-0.1.hum1@s390x, nodejs26-1:26.12.1-0.1.hum1@src +22
Fixes 7 records
TI-2026-74890 CVE-2026-109869 · GHSA-xjj6-f33q-929c
Unhandled error in undici fetch() crashes Node.js process
Priority LOW 39
undici is an HTTP client library for Node.js.
TI-2026-74992 CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm
Denial of service in undici via TLS renegotiation
Priority LOW 38
undici is an HTTP client library for Node.js.
Priority LOW 35
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
Priority LOW 34
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth dig…
TI-2026-74894 CVE-2026-109932 · GHSA-9fm3-97px-rjf6
Undici WebSocket client exhausts memory via unbounded PONG buffering
Priority LOW 33
undici is an HTTP client library for Node.js.
TI-2026-74893 CVE-2026-109924 · GHSA-4qv8-2p9j-2685
Unbounded memory in undici EventSource parser allows denial of service
Priority LOW 33
undici is an HTTP client library for Node.js.